Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use any Auth Method via annotation #215

Closed
pbar1 opened this issue Jan 19, 2021 · 1 comment
Closed

Use any Auth Method via annotation #215

pbar1 opened this issue Jan 19, 2021 · 1 comment
Labels
enhancement New feature or request

Comments

@pbar1
Copy link
Contributor

pbar1 commented Jan 19, 2021

Is your feature request related to a problem? Please describe.
Out of the box, the Vault Agent Injector does not support other Auth Methods than the kubernetes method using annotations alone.

Describe the solution you'd like
It would be great to be able to configure the Auth Method of the Agent that gets injected based on annotation alone. For example, such annotations as:

vault.hashicorp.com/auth-type: cert             # new annotation
vault.hashicorp.com/auth-path: auth/cert
vault.hashicorp.com/auth-config-name: pki-test  # new annotation
vault.hashicorp.com/ca-cert: /certs/ca.pem
vault.hashicorp.com/client-cert: /certs/client.pem
vault.hashicorp.com/client-key: /certs/client-key.pem

Should be able to generate config that looks like this:

{
  "auto_auth": {
    "method": {
      "type": "cert",
      "mount_path": "auth/cert",
      "config": {
        "name": "pki-test"
      }
    },
    "sink": <omitted for brevity>
  },
  "exit_after_auth": false,
  "pid_file": "/home/vault/.pid",
  "vault": {
    "address": "https://vault.vault.svc.cluster.local:8200",
    "ca_cert": "/certs/ca.pem",
    "client_cert": "/certs/client.pem",
    "client_key": "/certs/client-key.pem",
  },
  "template": <omitted for brevity>
}

Describe alternatives you've considered
The obvious alternative is using the vault.hashicorp.com/agent-configmap annotation to configure the agent from an existing ConfigMap. However, this solution requires the ConfigMap in question to already exist in order to be consumed - to use it in a preexisting Helm chart for example, one would have to modify the chart to explicitly create the ConfigMap explicitly. This isn't very declarative and violates the decorator-like pattern of annotations if used extensively.

Additional context
I've submitted a pull request extending the existing code to support this feature, #213. Let me know how I can help to get this feature merged. More details are in that PR.

@pbar1 pbar1 added the enhancement New feature or request label Jan 19, 2021
@pbar1
Copy link
Contributor Author

pbar1 commented Feb 26, 2021

Fixed by #213!

@pbar1 pbar1 closed this as completed Feb 26, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant